Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk
A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located...
actor
Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs
A solo Russian-speaking threat actor known as "bandcampro" outsourced a chunk of their operations to Google's open-source Gemini CLI artificial...
SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access
Ravie LakshmananJul 19, 2026Vulnerability / Network Security A previously undocumented threat actor has been attributed to the exploitation of recently...
Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet
Even though the actor managed to jailbreak the AI agent and bypass its safety controls for the operations mentioned above, the guardrail was still triggered on some occasions. In the instances...
Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access
Ravie LakshmananJul 10, 2026Enterprise Security / Authentication A threat actor has been targeting organizations spanning multiple sectors with voice-based fake...
Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes
Cybersecurity researchers have disclosed details of a new threat actor dubbed Lurking Lizard that has been operating an end-to-end malicious...
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
Ravie LakshmananJul 08, 2026Malware / Network Security A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware...
Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer
A previously undocumented threat actor known as Armored Likho has been attributed to cyber attacks targeting government agencies and the...
ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API
Ravie LakshmananJul 02, 2026API Security / Cyberespionage The threat actor known as ToddyCat has been attributed to a new malware...
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously...
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
Ravie LakshmananJun 26, 2026Cyber Espionage / Malware A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new...
Google Details Turla’s New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks
The Russian state-sponsored threat actor known as Turla has been attributed to a previously undocumented .NET backdoor called STOCKSTAY that...
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access
Ravie LakshmananJun 25, 2026Vulnerability / Threat Intelligence An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco...
Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments
Ravie LakshmananJun 17, 2026Malware / Social Engineering An unknown threat actor has been observed leveraging paid or promoted posts on...
Nintendo Alleged Data Breach: Threat Actor Demands $2M Ransom
Nintendo is facing a potential incident after a threat actor claimed to have stolen nearly a decade’s worth of internal...
